Virtual machine (VM) systems provide a guest operating system (OS) with a virtual execution platform comprising virtual hardware subsystems configured to emulate corresponding physical hardware subsystems. An instance of the virtual execution platform configured to execute the guest OS is commonly referred to as a virtual machine (VM). In a typical VM system, an arbitrary number of VMs may execute on a single physical host machine (or more simply, “host”). Each VM may operate independently with respect to other VMs and may communicate with the other VMs, for example via an emulated network interface. The host, through a virtualization software (e.g., hypervisor) running therein, should be configured with adequate computational and memory resources to support the VMs.
As in physical machines, security measures are implemented in VMs to combat malicious activity, such as corrupting memory or accessing privileged information. VM introspection tools, implemented in VMs as guest drivers, may be used to inspect the contents of the VM in real-time, and as described in U.S. application Ser. No. 13/430,868 and U.S. application Ser. No. 14/550,881, both of which are incorporated by reference herein, monitor events within the VM, and selectively report system events to various service appliances, such as a security service appliance configured with anti-virus and anti-malware scanning software.
As such, guest introspection drivers are key components in the VM's security framework and need to be shielded from kernel-level attacks or malicious programs, such as root kits. The possible root kit attack vectors include attempts to unload the driver or prevent the driver from loading, tampering with the driver code or data that are on disk or in memory, and tampering with the communication channel of the driver.